ICO consultation on the draft updated data 
sharing code of practice 


Qi Does the updated code adequately explain and advise on the new aspects of 
data protection legislation which are relevant to data sharing? 


© ves 
O No 


Q2 If not, please specify where improvements could be made. 
The new code is verging on being too lengthy. 


Q3 Does the draft code cover the right issues about data sharing? 


© Yes 
© No 


Q4 


Q5 


Q6 


Q7 


If no, what other issues would you like to be covered in it? 


The case studies are really helpful. I do think issues over anonymisation are worth adding 
further links to. A key issue I have seen many lengthy debates about it when there are 
controller(s) involved in anonymising personal data to share, but the other organisation who 
never holds the data did the requesting are they are controller too (since they may specify 
their requirements). Or an organisation claims it is joint controller but the contracting 
organisation forces them to be processor which can really restrict what they can do. Some 
guidance in these kinds of case studies or practical advice on how to deal with tricky 
negotiations would be helpful. 


Does the draft code contain the right level of detail? 
O Yes 
© No 


If no, in what areas should there be more detail within the draft code? 


There is too much detail. The bullet points in the text, e.g. what to include in a data sharing agreement, 
are great and | do not think a separate annex is necessary for a template. Also unnecessary to repeat 


aspects of GDPR and DPA in an annex when you already link to law and your other guidance earlier in 
code. 


Has the draft code sufficiently addressed new areas or developments in data 


protection that are having an impact on your organisation’s data sharing 
practices? 


O Yes 
© No 


Q8 Ifno, please specify what areas are not being addressed, or not being 
addressed in enough detail. 


Many of my colleagues would not consider a DPIA to be a "flexible and scalable tool" and view it as 


being an extra bureaucratic step. Also some more detail about special category data, particularly 
genomics - this would be v helpful for health researchers | work with. 


Q9 Does the draft code provide enough clarity on good practice in data sharing? 
O Yes 
© No 


Q10 If no, please indicate the section(s) of the draft code which could be improved, 
and what can be done to make the section(s) clearer. 
The data sharing agreements section is vague. Can any staff member get involved in drafting these or in 


using the word "agreement" are you prompting all organisations to seek legal advice for any data 
sharing? 


Qiii Does the draft code strike the right balance between recognising the benefits of 
sharing data and the need to protect it? 


© Yes 
© No 


Q12 If no, in what way does the draft code fail to strike this balance? 


Q13 Does the draft code cover case studies or data sharing scenarios relevant to 
your organisation? 


O Yes 
© No 


Q14 Please provide any further comments or suggestions you may have about the 
draft code. 


Issues of data sharing agreements for anonymised data would be helpful... should controllers 
provide instructions to recipients (what to call them, not processors) as to what to do if there 
is a breach e.g. re-identification. 


Q15 To what extent do you agree that the draft code is clear and easy to 
understand? 


© Strongly agree 

© Agree 

© Neither agree nor disagree 
© Disagree 

© Strongly disagree 


Q16 Are you answering as: 


O An individual acting in a private capacity (e.g. someone providing their 
views as a member of the public of the public) 


© An individual acting in a professional capacity 
© On behalf of an organisation 
O Other 


Q17 Please specify 
I am an Information Governance Manager 
Q18 Please specify 


Q19 Please specify 


Thank you for taking the time to share your views and experience. 


